Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Hackers Are Targeting AI Servers to Steal API Keys and Install Crypto Miners
Malware Families
Excerpt
Threat actors are increasingly targeting exposed AI infrastructure to steal model-provider API keys , abuse cloud-connected services, and deploy Monero cryptominers, according to new research from Wiz Threat Research. Wiz monitored honeypots designed to imitate commonly deployed AI and machine-learning services for 90 days, including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and other platforms. The researchers found attackers adapting their tools and…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-42271 | High | Score 66/100 | First seen |
| IP | 185.84.98.85 | High | Score 85/100 | First seen |
| IP | 185.62.1.8 | High | Score 58/100 | First seen |
| CVE | CVE-2026-48710 | Medium | Score 59/100 | First seen |
| CVE | CVE-2026-59822 | Medium | Score 54/100 | First seen |
IOC Relationship Graph
Building graph…